Race Condition: Quickly revoked MR Approval shows the MR as Not Approved, but merged anyway

Summary

It is possible to trigger a race condition where, upon quickly revoking approval for an MR, auto-merge still succeeds and the MR is merged in a way that shows it as unapproved. This is potentially problematic for auditing.

Steps to reproduce

  1. Create a project with a pipeline, and require approval for MRs
  2. Open an MR with a simple change
  3. Enable auto-merge on this MR, when all checks succeed
  4. Wait for the pipeline to succeed
  5. On a second account, approve the MR, then revoke the approval within 1 second
  6. Auto-merge should merge the MR. Logs will show the merge occurred after the approval was revoked.

Example MR

erisrenee/automerge-test!2 (merged)

What is the current bug behavior?

It is possible to revoke an approval in a short window after the auto-merge triggers, but before the merge completes. The merge succeeds anyway, leading to logs that imply the MR was merged without review.

Similarly, the reviewer panel says "approval is optional", even when approval is required, for merges affected in this way.

What is the expected correct behavior?

Either:

  • revoking the MR should reliably fail with an error (this is what happens when we don't trigger the race condition)
  • logs should show that the merge occurred before the MR was unapproved.

Relevant logs and/or screenshots

When we trigger the race condition and are able to revoke an approval:

Screenshot 2026-06-29 at 15.36.21.png

Screenshot 2026-06-29 at 15.42.40.png

Under normal conditions, when revoking the approval fails:

Screenshot 2026-06-29 at 15.44.03.png

Screenshot 2026-06-29 at 15.43.08.png

Output of checks

This bug happens on GitLab.com

Possible fixes

Unsure. One option I thought of is to trigger auto-merge less aggressively, perhaps implement a 5-10 second window before triggering an auto-merge, where a user can withdraw an approval submitted accidentally.